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1 Introduction 


This paper treats the problem of recovering sustainable non- 
descending (safe) flight in a transport aircraft after one or 
more of its control effectors fail. Such recovery can be a 
challenging goal for many transport aircraft currently in the 
operational fleet for two reasons. First, they have very little 
redundancy in their means of generating control forces and 
moments. These aircraft have, as primary control surfaces, 
a single rudder and pairwise elevators and aileron/spoiler 
units that provide yaw, pitch, and roll moments with suffi- 
cient bandwidth to be used in stabilizing and maneuvering 
the airframe. Beyond this, throttling the engines can pro- 
vide additional moments, but on a much slower time scale. 
Other aerodynamic surfaces, such as leading and trailing 
edge flaps, are only intended to be placed in a position and 
left, and are, hence, very slow-moving. Because of this, loss 
of a primary control surface strongly degrades the control- 
lability of the vehicle, particularly when the failed effector 
becomes stuck in a non-neutral position where it exerts a 
disturbance moment that must be countered by the remain- 
ing operating effectors. 

The second challenge in recovering safe flight is that these 
vehicles are not agile, nor can they tolerate large acceler- 
ations. This is of special importance when, at the outset 
of the recovery maneuver, the aircraft is flying toward the 
ground, as is frequently the case when there are major con- 
trol hardware failures. 

Recovery of safe flight is examined in this paper in the con- 
text of trajectory optimization. For a particular transport 
aircraft, and a failure scenario inspired by an historical air 
disaster, recovery scenari are calculated with and without 
control surface failures, to bring the aircraft to safe flight 
from the adverse flight condition that it had assumed, ap- 
parently as a result of contact with a vortex from a larger 
aircraft’s wake. An effort has been made to represent rel- 
evant airframe dynamics, acceleration limits, and actuator 
limits faithfully, since these contribute to the lack of agility 
and control power that plays an important role in defining 
what can be achieved with the vehicle when it is in extremis. 


2 Vehicle Model 

The aircraft model which is used in this study is adapted 
from a 6-degree-of-freedom simulation of Langley Re- 
search Center’s now-retired 737-100 research aircraft, doc- 
umented in [1,2]. The model assumes constant mass, ro- 
tating spherical Earth, and U.S. 1976 standard atmosphere 
[3] with no winds. The airframe dynamics are expressed in 
body axes, and vehicle attitude is propagated using quater- 
nions. 

The vehicle’s control effectors are rudder, flaps, horizon- 
tal stabilizer, elevator, aileron/spoiler, and right and left en- 
gines. The aerodynamic and thrust forces are represented 
as tabular functions of these variables, along with aerody- 
namic angles and airspeed or Mach number and altitude. 
This gave roughly 90 data tables drawn from the original 
simulation software, where they were used with piecewise 
multilinear table lookups. In order to preserve differentia- 
bility in the optimization model, a piecewise linear-quartic 
scheme (which fits multiquartic chamfers to the multilinear 
interpolant near tabulated points) was employed for table 
lookup. This software is documented in [4], The simulation 
model additionally included dependencies on aerodynamic 
angle rates and load factor, but these were ignored because 
of their small contributions to the dynamical response. 

The aerodynamic control surfaces are represented as inte- 
grators of control surface rate commands, subject to in- 
equality constraints on position and rate. For example, the 
elevator position 8e and rate Ce are related by 

8e = oe ( 1 ) 

subject to specified limits 


-a E <o E <o E AND 5 £ (L) < 8 E < 8£(V) (2) 

where the position limits are tabular functions of airspeed. 
This pattern holds true for all control surfaces except for 



aileron/sp oiler, whose position limits are tabular functions 
of altitude and Mach number, and the horizontal stabilizer, 
which has fixed mechanical limits. Each of the two engines 
is modelled separately. Thrust is a tabular function of engine 
pressure ratio, e, Mach and altitude; e itself satisfies 


( 0.3 e c >e + 03 

e = G e , Ge = < e c -e ELSE (3) 

{ -0.54 e c <e— 0.54 

where e c is the commanded value of e. 

Thus far, the ailerons and spoilers have been referred to as a 
single unit. This is because, on the study aircraft, hardware 
linkages couple their motion. In particular, the right spoiler 
deflection is related to aileron deflection 84 by 

§s R = max jo, ^ 8 ^ - || (4) 

where 8 a and 8 s R are expressed in degrees. The left spoiler 
mirrors this, deflecting when the aileron deflection is nega- 
tive. This relationship is not differentiable and, so, should 
confidently be expected to cause difficulty in optimiza- 
tion computations which require a guarantee of adequate 
smoothness for convergence. The aileron/spoiler linkage is 
modelled smoothly by driving the spoiler deflections from 
the aileron rate command o A , modified by a squashing func- 
tion on 8 a . Again, for the right spoiler, 
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%s R = 1+exp {25 - 208 . 4 } (5) 

It should be noted that the vehicle model from [1,2] included 
a number of logical branches in which calculated quan- 
tities changed discretely as vehicle states passed thresh- 
olds. These were carried into the optimization model, but 
smoothed using appropriately defined squashing functions. 


3 Trajectory Optimization Fonnulation 

In September 1994, a Boeing 737-300 aircraft, USAir Flight 
427, crashed on approach to Pittsburgh after encountering 
the vortex wake field of a passing 727 aircraft. Results from 
a simulation study of this 737, reconstructed from the re- 
covered flight data, indicated that the crash may have been 
due to adverse yaw moments caused by a stuck rudder [5]. 
This specific aircraft incident was selected as the testcase for 
the work reported in this paper. It should be noted that the 
USAir 427 aircraft was a 737-300, rather then the uniquely 
short-bodied Langley 737- 100 used in this study. The “300” 
is larger all around, with more powerful engines. Because 


we are studying the Flight 427 scenario, but applying it to a 
different transport aircraft, the results are of qualitative ap- 
plicability to the Flight 427 situation. 

Table 1 lists the vehicle state used as an initial condition for 
the study trajectories. Those quantities marked with an x 
in the left column were taken from [5] at the point in time 
where their simulation indicated that Flight 427’s rudder be- 
came stuck at 17.6 degrees of deflection. The engine pres- 
sure ratio values, en and ei, were not available in [5], but 
could be approximated from the data in the NTSB Accident 
Report for this incident [ 6 ]. The other displayed quantities 
were fit to the dynamics of the study aircraft. 


Table 1. USAir 427 adverse flight conditions. 


X 

Altitude 

5500 ft 

X 

Total velocity 

315 ft/sec 


X-body velocity 

306.22 ft/sec 


Y-body velocity 

54.15 ft/sec 


Z-body velocity 

-28.14 ft/sec 

X 

Roll angle 

-75 deg 

X 

Pitch angle 

-22 deg 

X 

Yaw angle 

25 deg 


Roll rate 

-4.69 deg/sec 


Pitch rate 

8.59 deg/sec 


Yaw rate 

-12.60 deg/sec 

X 

Vertical acceleration 

2.0 g 

X 

Longitudinal acceleration 

-0.35 g 


<?L , SR 

1.64 


These quantities were imposed as initial conditions on the 
trajectories discussed in the next section. Not shown are 
control surface initial conditions that were defined as a re- 
sult of the acceleration terms in Table 1 . 

The trajectory optimization results in the following section 
were obtained by approximating the solution of the plant 
equations by collocation, using a midpoint Euler discretiza- 
tion formula that provides 2 " rf -order accuracy, with equally 
spaced integration intervals. The optimization computa- 
tions were carried out using the SNOPT 5.3 [7] nonlin- 
ear programming code. Gradients of dynamics and con- 
straints were supplied to SNOPT analytically, and were ob- 
tained by applying the ADIFOR 2.1 [ 8 ] FORTRAN differ- 
entiation package to the source code that defines the plant 
model, constraints, and cost function. The organization of 
the various elements of this trajectory optimization prob- 
lem, including discretization, constraints, boundary condi- 
tions, cost function, ADIFOR-generated gradients, and the 
call to SNOPT is managed by MADS4.3 [9], a FORTRAN 
90/77 code developed at Langley Research Center. 

The key performance issue in recovery of safe flight is to 
recover while losing as little altitude as possible - in order 
to avoid ground contact - and without violating airframe 
and crew safety acceleration placards. This certainly makes 



selection of the cost function simple; i.e. maximize tenninal 
altitude. Since the aircraft is initially traveling downward, a 
nonpositive altitude rate 

h< 0 (6) 

is imposed throughout the trajectory, in order to assure a 
meaningful solution. After the solution is obtained, it is 
verified that (6) is never an active constraint on the solution. 
The acceleration placards constraining the recovery trajec- 
tories are given in Table 2. 

Table 2, Acceleration Placards 
Z-body acceleration +/- 2g 
Y-body acceleration +/- 1.5g 
Y-body acceleration rate +/- 2g/sec 

Having defined cost function, initial conditions, and plac- 
ard constraints, there remains termination of the recovery 
maneuver. Because of the degraded controllability of an 
aircraft with control effector failures, it may be difficult or 
impossible to bring the aircraft to a steady trim condition; 
furthermore, even if trimmed flight is possible, it may occur 
after the minimum altitude in the recovery trajectory has 
passed. Therefore, the terminal condition for these trajecto- 
ries was selected as 

h = O' 

V > 0 

< 0 > (7) 

00 < 0 
<|)(j) < 0 

where \|/, 0, and (|) are the euler angles. In other words, the 
aircraft has stopped descending, and has a non-negative en- 
ergy rate. If the airframe is rotating, it is rotating back to 
a centered position. This appears to ensure that the aircraft 
can be flown from the terminal point of the recovery maneu- 
ver without losing more altitude. 


4 Upset Recovery 

In this section, two main scenari are considered. First, re- 
covery from the initial conditions of Table 1 with minimum 
altitude loss is calculated with a healthy set of control effec- 
tors, to serve as an ideal baseline against which to consider 
the case of the rudder hardover suggested by [5]. In analyz- 
ing the "healthy" case we, in fact, consider two subscenari 
- recovery with the ailerons and spoilers linked using (5), 
and again, allowing the spoilers to operate independently of 
the ailerons. This was done because, at the time of writing, 
the authors are still wrestling with the problem of obtaining 


a solution for the stuck rudder case in which the ailerons 
and spoilers are linked, and which satisfies the placards in 
Table 2. This difficulty highlights the importance of los- 
ing a control effector in an aircraft with negligible control 
redundancy. 

Figures 1-9 display features of the recovery trajectories for 
the no-failure cases, computed using 40 integration inter- 
vals. The solid lines correspond to independent spoilers 
and the dash-dotted lines to coupled aileron/spoilers. The 
dashed lines, on the control surface histories, are their posi- 
tion limits. The maneuver is short in duration, lasting less 
than 5 seconds, and loses roughly 400 feet in altitude. It 
is also somewhat extreme, as can be seen from the accel- 
ration and euler angle plots. Unsurprisingly, allowing the 
spoilers to move independently enhances the performance; 
in this case, by roughly 6%. Note that, the flaps are ag- 
gressively used, decreasing V and enhancing lift. This turns 
out to be very important to recovering the vehicle. We have 
not been successful in computing a no-failure recovery ma- 
neuver that satisfied acceleration placards with realistically 
coupled aileron/spoiler, without using flaps. Interestingly, it 
looks as though the pilot could simply turn them on, then 
off at the outset of the maneuver, freeing his or her hands to 
wrestle with the yoke and throttles. This may, on examina- 
tion of further upset scenari, generalize to a trainable pilot 
action for recovering control. 

Figures 1 0- 1 9 display corresponding data for recovery (with 
independent spoilers) for the same initial conditions, but in- 
cluding a rudder hardover failure. Two trajectories are pre- 
sented. The optimized trajectory for maximizing altitude 
resulted in undesirable responses in the accelerations (Fig- 
ures 14 and 15). In order to determine the importance of 
these extraneous-looking temporal features, the trajectory 
was recalculated, adding a integral penalty on the sum of 
the squared control surface rates, scaled by 10 -2 . This was 
seen to have a fairly negligible effect on performance. In the 
Figures, the dash-dotted lines depict response without the 
control rate penalty and the solid lines are the response with 
it. Additionally, obeying the trajectory optimization rule of 
thumb that it is easier to solve a problem where the plant 
can meet the constraints easily than one where it can not, 
the object of the optimization problem was inverted from 
maximizing final altitude for a fixed rudder deflection to 
maximizing constant rudder deflection for a fixed final al- 
titude. This permitted variation of the rudder setting during 
the iterations, and dramatically eased the solution process. 
For an altitude loss of 4190 ft, the maximized rudder de- 
flection without the control rate penalty was 17.61 deg., and 
with it was 17.54 deg.; both of which correspond well to 
1 7.6 deg at which the data in Table 1 were drawn. 

The Figures show a trajectory that is startlingly different 
from the no-fail case on several counts. First, the trajec- 
tory duration is an order of magnitude larger. As can be 
seen from Figure 10, after the initial altitude loss, there is 



a leg where altitude is almost unchanged for the rest of the 
trajectory. This occurs shortly after 20 sec, and the change 
can be seen in the euler angle histories, as the aircraft labo- 
riously brings itself to a sustainable attitude. Although the 
aircaft speed is slowing down during the latter portion of the 
maneuver, the terminal V value is slightly positive, thus sat- 
isfying the terminal energy rate condition. During the whole 
of the maneuver, the vehicle wallows, with oscillating nor- 
mal and side accelerations of smaller magnitude than was 
seen in the no-fail case, consistent with the reduced avail- 
ability of control authority. It is interesting to note that there 
is almost no use of the flaps in this case. Instead, the inde- 
pendence of the spoilers is exploited, bringing them both up 
early on in the trajectory to accomplish the braking function. 


5 Conclusions 

Recovery of safe flight for a particular aircraft, in a specific 
initial adverse condition has been examined, with and with- 
out a specific control failure. It was seen that under optimal 
circumstances, the adverse vehicle state could be corrected 
with little altitude loss. In addition, a control failure which 
proved fatal in practice was corrected, assuming indepen- 
dently acting spoilers. Generalizing these results to a com- 
prehensive set of upset scenari will be time consuming, but 
could offer valuable heuristic piloting insights. 
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Independent Spoilers, Coupled Spoilers 



Figure 1: No Failure Mach Number vs. Altitude. 


Independent Spoilers, Coupled Spoilers 



Figure 2: No Failure Roll Angle. 


Independent Spoilers, Coupled Spoilers 



Figure 3: No Failure Pitch Angle. 






Independent Spoilers, Coupled Spoilers 


Independent Spoilers, Coupled Spoilers 



Figure 4: No Failure Yaw Angle. 


Independent Spoilers, Coupled Spoilers 



Timp Son 


Figure 5: No Failure Normal Acceleration. 


Independent Spoilers, Coupled Spoilers 



Figure 6: No Failure Side Acceleration. 


Independent Spoilers. Coupled Spoilers 



Time, See. 


Figure 7: No Failure Aileron. 



Figure 8: No Failure Right Spoiler. 


Independent Spoilers, Coupled Spoilers 



Figure 9: No Failure Flaps. 


With Penalty, No Penalty 



Figure 10: Stuck Rudder Altitude vs. Mach. 


With Penalty, — No Penalty 



Figure 11: Stuck Rudder Roll Angle. 
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Figure 12: Stuck Rudder Pitch Angle. 


With Penalty, - - No Penalty 
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Figure 13: Stuck Rudder Yaw Angle. 


With Penalty. No Penalty 



TimA. Sap. 


Figure 14: Stuck Rudder Normal Acceleration. 


With Penalty, — No Penalty 
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Figure 16: Stuck Rudder Aileron. 


With Penalty, No Penalty 



TimA Sap.. 


Figure 17: Stuck Rudder Right Spoiler. 


With Penalty, No Penalty 
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Figure 18: Stuck Rudder Left Spoiler. 


With Penalty, No Penalty 
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With Penalty, No Penalty 



TimA. Sac. 


Figure 15: Stuck Rudder Side Acceleration. 


Figure 19: Stuck Rudder Flaps. 











